github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-13 13:32:50 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/engine): expand %container.info extra format to empty string.

Browse Source 
Also, remove `container_id container_name` fields from `-pc` output.
These fields are now automatically appended since the `container` plugin
marks them as suggested.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro
2025-02-11 12:20:21 +01:00
committed by poiana
parent bb13702f0f
commit 9f1bc7d518
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
userspace/engine/rule_loader_compiler.cpp
View File

@@ -36,9 +36,12 @@ limitations under the License.
}
static std::string s_container_info_fmt = "%container.info";
static std::string s_default_extra_fmt =
"container_id=%container.id container_name=%container.name";
// We were previously expanding %container.info to "container_id=%container.id
// container_name=%container.name". Since the container plugin is now in use, and it exposes
// container.id and container.name as suggested output fields, we don't need to expand
// container.info anymore. We kept container.info in the ruleset to avoid a major breaking change.
// TODO: drop `container.info` magic once we make a major breaking change in the ruleset.
static std::string s_default_extra_fmt = "";
using namespace libsinsp::filter;
// todo(jasondellaluce): this breaks string escaping in lists and exceptions